Web Application Design Patterns- P3

Chia sẻ: Cong Thanh | Ngày: | Loại File: PDF | Số trang:30

Thêm vào BST

Báo xấu

98
lượt xem 13
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Web Application Design Patterns- P3: This is the type of book you’ll want to read with your entire team and a fl ip chart because every page will produce a list of actionable changes for the applications you’re developing. Pawan Vora has produced an amazing catalogue of the essential patterns for designing today’s web-based applications.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Web Application Design Patterns- P3

46 CHAPTER 2 Forms FIGURE 2.36 Adobe Buzzword shows an error message above the “Sign In” area. icon (or any other appropriate icon) to draw attention to the error message and/ or the form elements that caused the error(s) (Figure 2.37). PROVIDE INSTRUCTIONS TO FIX THE ERROR This could be as simple as asking users to do something simple and speciﬁc (e.g., “Reenter your username and password. Then click Log In”) to offer sug- gestions to ﬁx the error (e.g., “Username is case-sensitive. Check the Caps Lock key on your keyboard”). SHOW ERROR MESSAGES ON THE SAME PAGE AS THE FORM Web applications that show error messages on a different page force users to memorize the error(s) and the instructions to ﬁx them before returning to the form page containing errors. If there are several errors on a page, this can become cumbersome, because users may have to go back and forth several times to ﬁx all the errors. Showing error messages on the same page as the form eliminates the need to return to the page with the error message and makes it easier for users to ﬁx errors. RETAIN USER-ENTERED INFORMATION When showing error messages, it’s important that user-entered information is not lost. Asking users to enter the same information again is annoying and may lead them to abandon the form (Figure 2.38).
Error Messages 47 FIGURE 2.37 Washington Mutual’s login form clearly indicates that an error occurred and uses an alert icon to grab users’ attention to the error. FIGURE 2.38 SugarSync retains user information when presenting errors. Because passwords are not echoed back to users, it is acceptable to remove passwords if they are the cause of the error.
48 CHAPTER 2 Forms FIGURE 2.39 Highrise shows the error message on the same page and clearly indicates what needs to be done to ﬁx the error. IDENTIFY “PROBLEM” AREAS In addition to showing the error message, clearly identify the speciﬁc form ele- ments that caused the errors. This is particularly helpful for longer forms in which users may have to search for the form element(s) that caused the error (Figure 2.39). Related design patterns Although error messages are an important part of form design, every step should be taken to prevent errors. This can be accomplished by clearly indicat- ing required ﬁelds (REQUIRED FIELD INDICATORS), providing appropriate instructions for formatting and the type of data expected from users (INPUT HINTS/PROMPTS), minimizing user data input using appropriate defaults (SMART DEFAULTS), and allowing users to accept data in common formats (FORGIVING FORMAT).
CHAPTER 3 User Authentication 49 INTRODUCTION When web applications enable one-to-one interaction and store user-speciﬁc information, they require users to create an account (REGISTRATION) and choose unique credentials to access the web applications. Registering may require users to enter a set of alphanumeric characters from a distorted image to prevent spam and ensure that registering users are human and not auto- mated computer programs (CAPTCHA, Completely Automated Public Turing test to tell Computers and Humans Apart). Once unique credentials are established, users can identify themselves (LOG IN) and store and access their personal information. After logging in and accomplishing desired tasks, users often need a way to exit the application to ensure that unauthorized users cannot access and modify their account infor- mation (LOG OUT). Many applications also have provisions for automatically logging out users after a certain period of inactivity (AUTOMATIC LOGOUT). Because many web applications are used occasionally, users often forget their login information and need a way to retrieve it. Depending on the security level of the applications, users may be asked to provide one or more pieces of unique information about their account. It can be as simple as providing the email address associated with the account or answering one or more security questions that were established during registration (FORGOT USERNAME/PASSWORD). REGISTRATION Problem Web applications often need to uniquely identify users. The reasons include preventing unauthorized access to personal and sensitive information (e.g., ﬁnancial or health records), increasing convenience (e.g., storing billing and shipping addresses), and enabling sharing (e.g., photos). Despite such beneﬁts, users often hesitate when providing personal information and often shy away from applications that require them to set up an account.
50 CHAPTER 3 User Authentication FIGURE 3.1 Crazy Egg has one of the shortest and simplest registration forms. To register, users only need to provide their email address and password and agree to the terms of use and privacy policy. Solution Delay registration for as long as possible and allow users to explore the applica- tion so that they fully understand the beneﬁts of setting up an account. In addi- tion, if users are willing to forego some convenience, make it possible for them to transact without registering. Topix.net found a signiﬁcant increase in the num- ber of posts and a substantial improvement in their quality when they removed the registration requirement from their discussion forums (Blake, 2006). When registration unavoidable, clearly indicate the beneﬁts of registration and ask users only for the information necessary to set up an account (Figure 3.1). Why For most applications, setting up an account or registering is not one of the users’ goals. Their goals typically include purchasing an item, sharing informa- tion, paying bills, and so forth. Asking users to register is usually an interrup- tion in their interaction experience, since it distracts them from their primary goals. Therefore, registration should be delayed as long as possible. This is common in e-commerce applications (e.g., Amazon, Buy.com), content por- tals (e.g., Yahoo!, MSN, Morningstar), and content-sharing applications (e.g., Flickr, YouTube, SlideShare), which allow users to explore content without a user account. Only when users want to make a purchase, add content, make comments, or customize an application’s look and feel do these web applica- tions require users to register. Thus, delaying registration also allows users to experience the application’s beneﬁts and better understand the need and value of setting up an account. How First and foremost, keep registration forms as short as possible and ask only for essential information (Figure 3.2). For most applications, this includes a unique username (or user ID or email address) and associated password.
Registration 51 FIGURE 3.2 Wufoo, an online form-builder application, uses a simple registration form that asks only for the essential information for creating an account. Because users cannot see the password they entered, ask them to conﬁrm the password by reentering it. In addition, if required for legal reasons, ask them to agree to the usage terms and conditions. When users need to set up an account, it’s important that forms are as short as possible and ask only for relevant information so that users are distracted only for a very short period of time and can continue to accomplish their goals. Asking for nonessential information increases the time it takes to register and increases the chances of user errors. This may cause a user to abandon registra- tion or provide incorrect or nonsensical data. When asking users for any personally sensitive information, such as birth date, gender, race, and so forth, clearly indicate why the information is needed and how it will be used (Figure 3.3). CONSIDER USING AN EMAIL ADDRESS FOR A USERNAME When registering, users are often required to choose a unique identiﬁer for their account such as a username or email address. Email addresses are often a better choice because they are always unique and are easier to remember even when users have multiple email accounts. In addition, when users have to be reminded of their login credentials, it’s easier to send the reminder informa- tion to their registered email address (see FORGOT USERNAME/PASSWORD pattern later in this chapter). USE CAPTCHA TO ENSURE REGISTRATION BY HUMANS An increasing number of automated web crawlers have made it difﬁcult to dis- tinguish them from legitimate human users. Use CAPTCHA as part of the reg- istration form to minimize registration by such automated agents (Figure 3.4).
52 CHAPTER 3 User Authentication FIGURE 3.3 Papa John’s registration form justiﬁes asking users to enter their birth dates by indicating that they must be 13 or older to place an online order. FIGURE 3.4 Nabble asks users to respond to a CAPTCHA image when registering. CAPTCHA requires users to type characters from a distorted image containing letters and/or numbers before they can register. The ability to correctly identify characters from the distorted image is used as sufﬁcient evidence that the user is human and not an automated agent (see the CAPTCHA pattern next). Although the use of CAPTCHA is becoming common, it is yet one more piece of information users have to provide and should be avoided, if possible.
Registration 53 Calbucci (2008) found that removing CAPTCHA from the registration form improved the conversion rate by 9.2 percent on Sampa (www.sampa.com). CONSIDER THE “LAZY” REGISTRATION APPROACH As mentioned, registration is often an interruption in users’ interaction expe- rience. Therefore, delay registration as much as possible and allow users to explore the application before asking them to register. For instance, Morningstar asks users to register or log in only when they land on a page that requires them to provide sensitive information (e.g., creating an investment portfolio) or when they are accessing content reserved for paying customers. To make the registration process as efﬁcient as possible, even when it is delayed, an option is to use a “lazy” registration approach, which is collecting information about users using browser cookies as they interact with the appli- cation. As Mahemoff (2006) states: As the user interacts with the application, the account accumulates data. In many cases, the data is explicitly contributed by the user, and it’s advisable to expose this kind of information so that the user can actually populate it. In this way, the initial proﬁle may be seen as a structure with lots of holes. Some holes are eventually ﬁlled out automatically and others by the user himself. (p. 475) By collecting information in the background, when users are presented with the registration form, some of the registration ﬁelds can be prepopulated, requiring users to verify collected information rather than enter it. For example, if a user signs up for an email newsletter, the application has the user’s email address, which it can prepopulate on the registration form. CONSIDER ELIMINATING REGISTRATION Offer users the option to have access without registering in applications where they may just want to complete transactions quickly. This is common in e-commerce applications, especially those that support gift registries, where users may just want to purchase a gift and leave the application (Figure 3.5). Users may be prompted to register at the end of the transaction (or checkout process) with clearly listed beneﬁts for doing so (e.g., track the order). CLEARLY INDICATE REGISTRATION BENEFITS For web applications where it’s not possible to delay registration, clearly indi- cate registration beneﬁts to users (Figure 3.6). For many applications, listing beneﬁts may not be sufﬁcient, especially when registering is not free. In such instances, offer users the option to take a guided tour that explains the beneﬁts of using the application and/or allow them to set up a free-trial account for a limited time period or with restricted functionality (Figure 3.7).
54 CHAPTER 3 User Authentication FIGURE 3.5 Ofﬁce Depot offers users the option to purchase without registering. It also allows users to defer the registration decision until later, indicating that they can set up an account at the end of the checkout process. FIGURE 3.6 Netﬂix not only lists registration beneﬁts but also indicates on the same page how Netﬂix works. It offers links to users who want to learn more about the free trial offer or about movie selection and goes a step further by offering a phone number for users to call in case they have any questions. CONSIDER USING “UNIFIED REGISTRATION” SERVICES Remembering login information for more than a few applications can be dif- ﬁcult for users and lead to practices that could compromise the security of their personal information (e.g., writing down login information or using very simple passwords). Even when security is not a concern, forgetting login infor- mation could result in unnecessary delays in accomplishing tasks. Therefore, if feasible, allow users to register using “uniﬁed registration” services such as OpenID or Windows CardSpace. An OpenID is an open standard that allows users to create and use one set of username and password to log in to any OpenID-enabled web application; for more information, visit www.openid.net. Thus, enabling support for OpenID can
Registration 55 FIGURE 3.7 Basecamp (from 37Signals) offers users an application tour so they can explore its functionality and beneﬁts. It also allows users to sign up for a free-trial account so they can experience the application ﬁrsthand. Although the free-trial account has restricted functionality it makes it possible for users to easily understand the beneﬁts of having an account. FIGURE 3.8 Ma.gnolia offers users a regular registration process where they choose their login credentials, as well as supports registration using OpenID. either eliminate the need for registration or at least minimize the information required from users to set up an account (Figure 3.8). Because not all users can be expected to have OpenID accounts, supporting a normal registration pro- cess is still important.
56 CHAPTER 3 User Authentication FIGURE 3.9 YouTube asks users to click the conﬁrmation link in the email to complete their registration and then to check their spam folders if they don’t see the message appear in their inbox within a few minutes. FIGURE 3.10 Prosper provides a brief summary of their privacy policy on the registration form, as well as offers a link to a detailed privacy policy. VERIFY REGISTRATION If necessary, require users to verify their registration to prevent fraud and ensure legitimate user accounts. This is commonly accomplished by sending a message with a conﬁrmation link to the email address provided by users during registra- tion. Only after users have returned to the application by clicking the conﬁrma- tion link (or by pasting the registration URL in their browser address ﬁeld) do they consider their registration complete. To ensure email reaches users’ email inboxes, ask them to check their spam folders (Figure 3.9). ALLAY USERS’ PRIVACY CONCERNS Users may be hesitant to register because they may not know how their per- sonal information will be used. Include a brief privacy statement (e.g., “Your information will not be sold or shared”) followed by a link to a detailed pri- vacy policy statement to address such concerns (Figure 3.10).
Registration 57 FIGURE 3.11 When setting up an account, CapitalOne requires users to set up security questions. SET UP SECURITY QUESTIONS WHEN STORING SENSITIVE INFORMATION Use security questions for web applications that require a higher level of security, such as for ﬁnancial applications (Figure 3.11). Security questions can then be used to establish users’ identities when they log in and/or when they need help retrieving their forgotten login information (see the FORGOT USERNAME/PASSWORD pattern later in this chapter). OPT-IN Ask users to opt in instead of opt out if the company supporting the web appli- cation plans to communicate with them in the future or send promotional information (Figure 3.12). This is the ﬁrst step to making sure email sent to users is CAN-SPAM1 compliant (Dixon, 2004; see also the Federal Trade Commission’s SPAM home page at www.ftc.gov/spam/). The better practice is to use double opt-in, where upon opting in, users are sent an email conﬁrmation with a link that they must click to ﬁnish the opt-in process. In addition, set users’ expectations by explaining how frequently they will receive communication and what kind of messages will be sent. With the pos- sibility of email communication being stopped by spam ﬁlters, ask users to adjust their spam ﬁlter settings appropriately or add the “from email address” to their contact lists. RETURN USERS TO THE NEXT LOGICAL STEP IN THE INTERACTION SEQUENCE Upon the completion of registration, return users to the “page of departure”— that is, the page from where they chose to register or were required to register. 1 CAN-SPAM is a commonly used acronym for Controlling the Assault of Non-Solicited Por nography and Marketing Act of 2003. It became a law on January 1, 2004, and applies to most businesses in the United States that send commercial email. It provides email recipients with the right to opt out (unsubscribe).
58 CHAPTER 3 User Authentication FIGURE 3.12 Evite offers users a clear opt-in option for sending party tips and planning ideas. For example, in an e-commerce application, if users are asked to register at checkout, return them to the page they are likely to see if they were already reg- istered or logged in, such as the shipping information page. Related design patterns For many web applications, registration may be the ﬁrst form users encoun- ter. To create a successful user experience, it’s important to follow the patterns identiﬁed in Chapter 2—CLEAR BENEFITS, SHORT FORMS, REQUIRED FIELD INDICATORS, and ERROR MESSAGES. When presenting the registration form to users, it is important that they be given an option to LOG IN since they may have registered previously. In addition, because CAPTCHA often accompanies registration, follow the best practices identiﬁed in the following pattern. CAPTCHA Problem The application needs to make sure that the action (e.g., register, provide feed- back, send comment, and so forth) is initiated by a human rather than an auto- mated agent to prevent creation of fraudulent accounts and fake responses. Solution Ask users to type characters from a distorted image that contains letters and/or numbers before they can register or provide comments or feedback (Figure 3.13).
CAPTCHA 59 FIGURE 3.13 CAPTCHA on Yahoo!’s registration page. Decoding distorted images is used as a validation that a user is human and not an automated agent, since automatically decoding a distorted image is compu- tationally intensive. This method is referred to as CAPTCHA, which stands for Completely Automated Public Turing test to tell Computers and Humans Apart (Ahn, Blum, and Langford, 2004).2 Why An increasing number of automated crawlers on the Web have made it difﬁ- cult to distinguish them from legitimate human users. By asking users to do something that is relatively easy for humans to do but difﬁcult for automated crawlers, the use of CAPTCHA makes it difﬁcult, if not impossible, for bots and crawlers to interact with the application and submit forms. How CAPTCHA images typically have about four to ﬁve distorted alphanumeric characters; the alphabetical characters in the image may include both uppercase and lowercase ones. In addition, they may have lines through them, more than one distorted word, noisy backgrounds, and so forth (Figure 3.14). Users are asked to decode the image and enter the alphanumeric characters in the cor- rect order (they may or may not be case sensitive) before submitting the form. Upon form submission, the response is veriﬁed, and users are either taken to the next step or presented with an error. Recently, some sites have included simple math problems in CAPTCHA images such as 2 4 or 4 2 that users must answer (Figure 3.15). ALLOW USERS TO CHANGE THE CAPTCHA IMAGE Users may ﬁnd some CAPTCHA images too distorted to distinguish between some characters (e.g., the number 1 versus a lowercase l, or the number 9 versus 2 Many CAPTCHA images on the Web use the free CAPTCHA service offered by Carnegie Mellon University as part of their reCAPTCHA project, which helps digitize books by sending users digi- tized words as CAPTCHA that cannot be read by their OCR (optical character recognition) pro- grams. For more information, visit www.recaptcha.net.
60 CHAPTER 3 User Authentication FIGURE 3.14 Examples of CAPTCHA images. FIGURE 3.15 Two examples of math CAPTCHA. FIGURE 3.16 Nabble offers users the option to change the CAPTCHA image. a lowercase g). Therefore, users should be offered the option to change the CAPTCHA image by clicking on a “refresh” or “change” link (Figure 3.16). OFFER AUDITORY CAPTCHA TO MAKE APPLICATIONS ACCESSIBLE Because CAPTCHA is based on decoding the image, it presents an obvious obstacle for blind users or those with visual disabilities. They should be offered
Log In 61 FIGURE 3.17 Gmail offers both visual and auditory CAPTCHA. a voice CAPTCHA—an audio version of CAPTCHA—that allows them to inter- act with the application (Figure 3.17). Related design patterns Use of CAPTCHA is common during registration, as most applications try to avoid fraudulent registrations by automated web crawlers (REGISTRATION). They are also common in discussion forums or blogs, where users can make comments or participate in communities (see the GROUPS/SPECIAL INTEREST COMMUNITY pattern in Chapter 9). LOG IN Problem Users need to identify themselves so that they can access their account infor- mation and/or see customized or personalized versions of the web application. For example, users may want to check their emails (e.g., Hotmail, Yahoo! Mail), access their account to see the order status on an e-commerce application (e.g., Amazon, Dell), or see the customized version of their content portals (e.g., My Yahoo!, iGoogle). Solution Ask users to identify themselves by providing a combination of a unique iden- tiﬁer (e.g., username or email address) and password that they either chose when registering with the application or that was provided to them by the sys- tem administrator. Universal identity services that uniquely identify users, such as OpenID or Windows CardSpace, can be used as well to allow users to access a web application (Figure 3.18). In addition, to make it easy to access the application, consider offering users an option to let the application remember their login information. Why When a web application allows users to access their personal and/or sensitive information, it is important that users identify themselves by logging in with
62 CHAPTER 3 User Authentication (a) (b) FIGURE 3.18 Basecamp allows users to log in using the username and password they chose during registration (a) or with their OpenID (b). Users may also choose to let the application remember their login information. a unique set of credentials that they established while registering with the application. While logging in is an important task to secure account infor- mation and avoid unauthorized access, users may consider it an obstacle to accomplishing their goals. In addition, for applications not visited frequently, users may forget their login credentials and may be locked out for some time period. Therefore, where feasible, users should be offered the option to let the
Log In 63 FIGURE 3.19 Amazon lets users know they are logging in using their secure server. application remember their login information. Offering users a “remem- ber me” option eliminates the need to log in and makes it easier for them to accomplish their goals without unnecessary interruptions. How Require users to log in using their username or email and the password they provided during registration. However, like registration, logging in is an inter- ruption to a user’s interaction experience. Therefore, delay it as much as pos- sible. When logging in cannot be delayed for business reasons—for example, users must log in to select their delivery or pick-up store for ordering from food chains such as Domino’s or Pizza Hut for franchise obligations—consider alternative means for getting users closer to their goal—for example, ask them to provide their street address and/or zip code. ECHO USERS’ PASSWORDS WITH NONCHARACTERS Use the HTML tag for the password ﬁeld. It instructs the web browser to echo users’ input as asterisks or bullets in the password ﬁeld. However, because users don’t receive any feedback on what they are entering, when a login error occurs, remove users’ input from the password ﬁelds. In addition, ask them to check the “Caps Lock” key if passwords are case-sensitive. WHEN NECESSARY, OFFER SECURE LOGIN When allowing users to access personal information that is sensitive in nature, make the login process “secure” by transmitting the information over a Secure Sockets Layer (SSL) connection. Also, let users know they are logging in using a secure protocol (Figure 3.19). This can help increase users’ trust in the web application. OFFER USERS AN OPTION TO REGISTER Designers usually strive to make their web applications more convenient to repeat users and typically ask users to log in only when they need to identify
64 CHAPTER 3 User Authentication FIGURE 3.20 Target offers users the option to register on the sign in (i.e., log in) page. themselves. Considering that users may not have registered with the web appli- cation, it’s important that they be offered an option to register (Figure 3.20). ENABLE USERS TO RETRIEVE FORGOTTEN LOGIN INFORMATION Users often forget their login information, especially when they do not access a web application frequently. Help users to retrieve forgotten login information by offering options such as “Forgot password?” and/or “Forgot username or password?” (Figure 3.21); see the FORGOT USEERNAME/PASSWORD pattern later in this chapter. CONSIDER A TWO-STEP LOGIN FOR HIGHER SECURITY For security reasons, many ﬁnancial applications require a two-step login to verify a user’s identity. The ﬁrst step is very similar to the login process described so far—that is, asking users to provide their username or user ID and password. The second step requires users to answer a security question. The answer must match the one provided during registration for them to success- fully log in and access their account (Figure 3.22). Although many ﬁnancial institutions require users to respond to a randomly selected security question, it may become annoying for users to answer security questions every time they log in. To minimize frustration, offer users the option to skip the additional step by registering the computer they typically use to log in.
Log In 65 FIGURE 3.21 Yahoo! offers a “Forgot your ID or password?” link below the “Sign In” button and offers new users an option to register using a “Sign Up” link. SINGLE SIGN-ON (SINGLE LOGIN) Many web applications, especially business-to-business (that is, extranet) and business-to-employee (that is, intranet) applications, allow users to access one or more related applications based on their access rights. Such additional applications should be enabled for single sign-on (commonly referred to as SSO) so that once users have logged in, the same credentials are used to ver- ify their identity with other applications. Users’ transition from one applica- tion to another should be seamless, and they should feel they are using the same application. For instance, once users have logged in to their Google Mail account, they do not have to log in again for accessing related applications such as Google Calendar and Google Documents. CONSIDER ALLOWING THE USE OF “UNIVERSAL LOGIN” SERVICES As mentioned earlier, allow users to log in using “universal login” services such as OpenID and Windows CardSpace (Figure 3.23). Such services allow users to create a unique digital identiﬁer and use it to log in to any application support- ing its use. This is similar to the SSO approach, except that users’ credentials are maintained by a third-party identity provider rather than the web applica- tion provider.